CVE-2024-5907 is a local privilege escalation in the Palo Alto Networks Cortex XDR agent on Windows. NVD scores it 7.0 (High) and Palo Alto Networks rates it 5.2 (Medium). It needs a race condition to be won, so it is hard to exploit. Fixed builds exist for 8.3, 8.2 and 7.9-CE.
What's affected
The NVD record describes a flaw in the Cortex XDR agent on Windows that lets a local user run programs with elevated privileges. The weakness is CWE-269, improper privilege management. The NVD vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, which reads as local, high complexity, low privileges.
Palo Alto Networks lists the following on its advisory page (Windows only):
- 8.4: not affected
- 8.3: affected before 8.3.1, fixed in 8.3.1 and later
- 8.2: affected before 8.2.3, fixed in 8.2.3 and later
- 7.9-CE: affected before 7.9.102-CE, fixed in 7.9.102-CE and later
- 8.1: affected, and the advisory says it will not be fixed because that version reached end of life on 9 April 2024
Severity conflict. NVD gives 7.0 High. The vendor advisory gives a CVSS-B score of 5.2 (Medium, from CVSS 4.0) and a suggested urgency of Moderate. Both are quoted here because they use different scoring versions and inputs. The vendor says it is not aware of any malicious exploitation, and the record does not mark the CVE as known exploited.
How to check if you're exposed
Check the agent version on each Windows endpoint from the Cortex XDR console, or locally in the agent interface. Compare it with the table above.
The advisory lists no workaround, so the version number is the whole test. Endpoints on 8.1 deserve special attention because there is no patch coming for that branch.
What to do now
- Inventory every Windows endpoint running the Cortex XDR agent and group them by release branch.
- Upgrade 8.3 endpoints to 8.3.1 or later, 8.2 endpoints to 8.2.3 or later, and 7.9-CE endpoints to 7.9.102-CE or later.
- Move any endpoint still on 8.1 to a supported branch, since the vendor will not patch it.
- Keep ordinary users off machines where you cannot yet upgrade, and review who has local logon rights.
- Re-run your inventory after the rollout to confirm no old builds remain.
Why it matters
A race condition bug depends on timing. Two operations that should happen in a safe order can be made to overlap, and a privileged component then acts on something an unprivileged user changed in the gap. That is why the vector rates complexity as high.
Endpoint security agents run with high privileges by design, so a local flaw in one is worth fixing even when the score is moderate. The attacker already needs code running on the machine, which limits the risk, but agents are the kind of software that attackers study after an initial foothold.
Quick check
Is CVE-2024-5907 exploited in the wild?
Palo Alto Networks says it is not aware of any malicious exploitation, and the record shows the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Is there a workaround?
The advisory lists none. Upgrading is the remediation.
Sources
- Palo Alto Networks advisory for CVE-2024-5907
- NVD record for CVE-2024-5907
- Gold entry
Last reviewed: 19 October 2026.
